Cloud Vulnerability DB
A community-led vulnerabilities database
AI for Security Summit: Join Figma, Perplexity & Wiz. [Register]
Vulnerability DatabaseCVE-2024-28568
CVE-2024-28568:
Homebrew vulnerability analysis and mitigation
Overview
CVE-2024-28568 is a Buffer Overflow vulnerability discovered in FreeImage version 3.19.0 [r1909]. The vulnerability was disclosed on March 20, 2024, affecting the read_iptc_profile() function when processing TIFF format images (NVD).
Technical details
The vulnerability exists in the read_iptc_profile() function within the TIFF processing component of FreeImage. When reading images in TIFF format, the function contains a heap overflow read vulnerability. The issue has been assigned a CVSS v3.1 Base Score of 6.2 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating local access is required but no privileges or user interaction are needed (NVD).
Impact
The exploitation of this vulnerability can lead to a Denial of Service (DoS) condition in the affected system. The vulnerability specifically affects the read_iptc_profile() function when processing TIFF format images (GitHub Report).
Exploitability
The vulnerability requires local access to exploit, with no privileges or user interaction needed. The attack complexity is low, making it relatively straightforward to exploit once an attacker has local access to the system (NVD).
Mitigation and workarounds
As of January 16, 2025, no patch is available upstream for this vulnerability. Multiple Linux distributions, including Ubuntu, have marked this vulnerability as 'fix deferred' across various releases (Ubuntu Security).
Additional resources
Linux Distribution fix status
Fix availability across major Linux distributions and their releases.
Source: This report was generated using AI
Related Homebrew vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management